281 lines
8.3 KiB
Python
281 lines
8.3 KiB
Python
"""Broker configuration management (spec sections 25-27, 30, 31, 61).
|
|
|
|
Release 1 flow: edit model -> generate -> validate via control sidecar ->
|
|
deploy (activate + reload) -> revision recorded. Diffs and approval
|
|
workflow arrive with Release 2/3 polish, but every deploy already creates
|
|
an immutable revision (spec section 26).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
from datetime import UTC, datetime
|
|
from typing import Annotated
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app import audit
|
|
from app.config import get_settings
|
|
from app.configgen import generate_config
|
|
from app.db import get_db
|
|
from app.deps import CurrentUser, require_roles
|
|
from app.models import (
|
|
BrokerSettings,
|
|
ConfigRevision,
|
|
ListenerConfig,
|
|
ManagementRole,
|
|
)
|
|
from app.schemas import (
|
|
BrokerSettingsIn,
|
|
ConfigPreviewOut,
|
|
DeployRequest,
|
|
ListenerIn,
|
|
ListenerOut,
|
|
RevisionDetailOut,
|
|
RevisionOut,
|
|
)
|
|
|
|
router = APIRouter(prefix="/api/v1/broker", tags=["broker"])
|
|
|
|
BrokerAdmin = Annotated[CurrentUser, Depends(require_roles(ManagementRole.BROKER_ADMIN))]
|
|
AnyReader = Annotated[
|
|
CurrentUser,
|
|
Depends(
|
|
require_roles(
|
|
ManagementRole.BROKER_ADMIN,
|
|
ManagementRole.OPERATOR,
|
|
ManagementRole.AUDITOR,
|
|
)
|
|
),
|
|
]
|
|
|
|
|
|
def _next_revision_number(db: Session) -> int:
|
|
highest = db.scalar(
|
|
select(ConfigRevision.revision_number).order_by(
|
|
ConfigRevision.revision_number.desc()
|
|
)
|
|
)
|
|
return (highest or 0) + 1
|
|
|
|
|
|
def _call_control(
|
|
path: str, *, method: str = "POST", json_body: dict | None = None
|
|
) -> dict:
|
|
settings = get_settings()
|
|
headers = {"Authorization": f"Bearer {settings.control_api_token}"}
|
|
try:
|
|
with httpx.Client(base_url=settings.control_base_url, timeout=30) as client:
|
|
response = client.request(
|
|
method, path, headers=headers, json=json_body
|
|
)
|
|
except httpx.TransportError as exc:
|
|
raise HTTPException(
|
|
status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
f"broker control service unreachable: {exc}",
|
|
) from exc
|
|
if response.status_code >= 400:
|
|
detail = response.json().get("error", response.text)
|
|
raise HTTPException(response.status_code, detail)
|
|
return response.json()
|
|
|
|
|
|
# --- Listeners ---------------------------------------------------------------
|
|
|
|
|
|
@router.get("/listeners", response_model=list[ListenerOut])
|
|
def list_listeners(db: Annotated[Session, Depends(get_db)], _user: AnyReader):
|
|
return db.scalars(select(ListenerConfig)).all()
|
|
|
|
|
|
@router.post("/listeners", response_model=ListenerOut, status_code=201)
|
|
def create_listener(
|
|
body: ListenerIn,
|
|
request: Request,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
_user: BrokerAdmin,
|
|
):
|
|
listener = ListenerConfig(**body.model_dump())
|
|
db.add(listener)
|
|
db.flush()
|
|
audit.record(
|
|
db,
|
|
"LISTENER_CREATED",
|
|
request=request,
|
|
object_type="listener",
|
|
object_id=str(listener.id),
|
|
new_value={"name": body.name, "port": body.port},
|
|
)
|
|
return listener
|
|
|
|
|
|
@router.put("/listeners/{listener_id}", response_model=ListenerOut)
|
|
def update_listener(
|
|
listener_id: uuid.UUID,
|
|
body: ListenerIn,
|
|
request: Request,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
_user: BrokerAdmin,
|
|
):
|
|
listener = db.get(ListenerConfig, listener_id)
|
|
if listener is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "listener not found")
|
|
for key, value in body.model_dump().items():
|
|
setattr(listener, key, value)
|
|
db.flush()
|
|
audit.record(
|
|
db,
|
|
"LISTENER_UPDATED",
|
|
request=request,
|
|
object_type="listener",
|
|
object_id=str(listener.id),
|
|
new_value={"name": body.name, "port": body.port},
|
|
)
|
|
return listener
|
|
|
|
|
|
@router.delete("/listeners/{listener_id}", status_code=status.HTTP_204_NO_CONTENT)
|
|
def delete_listener(
|
|
listener_id: uuid.UUID,
|
|
request: Request,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
_user: BrokerAdmin,
|
|
):
|
|
listener = db.get(ListenerConfig, listener_id)
|
|
if listener is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "listener not found")
|
|
db.delete(listener)
|
|
audit.record(
|
|
db,
|
|
"LISTENER_DELETED",
|
|
request=request,
|
|
object_type="listener",
|
|
object_id=str(listener.id),
|
|
)
|
|
return None
|
|
|
|
|
|
# --- Global settings -----------------------------------------------------------
|
|
|
|
|
|
@router.get("/settings", response_model=list[BrokerSettingsIn])
|
|
def list_settings(db: Annotated[Session, Depends(get_db)], _user: AnyReader):
|
|
return db.scalars(select(BrokerSettings)).all()
|
|
|
|
|
|
@router.put("/settings/{key}", response_model=BrokerSettingsIn)
|
|
def upsert_setting(
|
|
key: str,
|
|
body: BrokerSettingsIn,
|
|
request: Request,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
_user: BrokerAdmin,
|
|
):
|
|
if body.key != key:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, "key mismatch")
|
|
setting = db.scalar(select(BrokerSettings).where(BrokerSettings.key == key))
|
|
if setting is None:
|
|
setting = BrokerSettings(key=key, value=body.value, value_type=body.value_type)
|
|
db.add(setting)
|
|
else:
|
|
setting.value = body.value
|
|
setting.value_type = body.value_type
|
|
db.flush()
|
|
audit.record(
|
|
db,
|
|
"BROKER_SETTING_CHANGED",
|
|
request=request,
|
|
object_type="broker_setting",
|
|
object_id=key,
|
|
new_value={"value": body.value},
|
|
)
|
|
return setting
|
|
|
|
|
|
# --- Generation, validation, deployment ----------------------------------------
|
|
|
|
|
|
@router.get("/config/preview", response_model=ConfigPreviewOut)
|
|
def preview_config(
|
|
db: Annotated[Session, Depends(get_db)], _user: AnyReader
|
|
):
|
|
"""Show the generated mosquitto.conf without deploying (spec section 32)."""
|
|
result = generate_config(db)
|
|
return ConfigPreviewOut(config_text=result.config_text, warnings=result.warnings)
|
|
|
|
|
|
@router.post("/config/validate")
|
|
def validate_config(
|
|
db: Annotated[Session, Depends(get_db)], _user: BrokerAdmin
|
|
):
|
|
"""Generate + validate against the real broker binary (spec section 27)."""
|
|
result = generate_config(db)
|
|
response = _call_control("/deploy", json_body={"content": result.config_text})
|
|
# NOTE: /deploy both validates AND activates. Release 1 keeps the
|
|
# combined flow; Release 2 splits validate-only via a staged endpoint.
|
|
return response
|
|
|
|
|
|
@router.post("/config/deploy")
|
|
def deploy_config(
|
|
body: DeployRequest,
|
|
request: Request,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
user: BrokerAdmin,
|
|
):
|
|
"""Generate -> validate -> activate + reload -> record revision."""
|
|
result = generate_config(db)
|
|
response = _call_control("/deploy", json_body={"content": result.config_text})
|
|
if response.get("status") != "deployed":
|
|
raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, response)
|
|
|
|
revision = ConfigRevision(
|
|
revision_number=_next_revision_number(db),
|
|
created_by=user.username,
|
|
comment=body.comment,
|
|
config_text=result.config_text,
|
|
validation_result=response,
|
|
deployed=True,
|
|
deployed_at=datetime.now(UTC),
|
|
)
|
|
db.add(revision)
|
|
audit.record(
|
|
db,
|
|
"BROKER_CONFIG_DEPLOYED",
|
|
request=request,
|
|
user=user.username,
|
|
object_type="config_revision",
|
|
object_id=str(revision.revision_number),
|
|
new_value={"comment": body.comment},
|
|
)
|
|
return {
|
|
"status": "deployed",
|
|
"revision": revision.revision_number,
|
|
"broker_healthy": response.get("broker_healthy"),
|
|
}
|
|
|
|
|
|
@router.get("/revisions", response_model=list[RevisionOut])
|
|
def list_revisions(
|
|
db: Annotated[Session, Depends(get_db)], _user: AnyReader
|
|
):
|
|
return db.scalars(
|
|
select(ConfigRevision).order_by(ConfigRevision.revision_number.desc())
|
|
).all()
|
|
|
|
|
|
@router.get("/revisions/{number}", response_model=RevisionDetailOut)
|
|
def get_revision(
|
|
number: int,
|
|
db: Annotated[Session, Depends(get_db)],
|
|
_user: AnyReader,
|
|
):
|
|
revision = db.scalar(
|
|
select(ConfigRevision).where(ConfigRevision.revision_number == number)
|
|
)
|
|
if revision is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "revision not found")
|
|
return revision |